Node.js Package pug before 3.0.1 Arbitrary Code Execution

Overview

Node.JS Package pug before 3.0.1 is vulnerable to arbitrary code execution.

Description

Pug is an npm package that is a high-performance template engine. In pug before version 3.0.1, if a remote attacker is able to control the ‘pretty’ option of the pug compiler, e.g. if you spread a user-provided object such as the query parameters of a request into the pug template inputs, it is possible for them to achieve remote code execution on the node.js backend.

Impact

The pug may allow an attacker to inject arbitrary javascript code if an attacker can control ‘options.pretty’.

Arbitrary code injection can lead to loss of data integrity as the control-plane data injected is always incidental to data recall or writing, injectable code controls authentication.